Merge branch 'main' into feature/nso-slo

Author: OscarLlamas6

PROJECT

@@ -97,4 +97,13 @@ resources:
   kind: HTTPProxy
   path: go.datum.net/network-services-operator/api/v1alpha
   version: v1alpha
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: datumapis.com
+  group: networking
+  kind: Domain
+  path: go.datum.net/network-services-operator/api/v1alpha
+  version: v1alpha
 version: "3"

api/v1alpha/domain_types.go

@@ -8,31 +8,34 @@ import (
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Domain",type="string",JSONPath=".spec.domainName"
-// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=`.status.conditions[?(@.type=="Ready")].status`
-// +kubebuilder:printcolumn:name="Reason",type="string",JSONPath=`.status.conditions[?(@.type=="Ready")].reason`
-// +kubebuilder:printcolumn:name="Registrar",type="string",JSONPath=".status.registrar.ianaName"
-// +kubebuilder:printcolumn:name="DNSSEC",type="boolean",JSONPath=".status.registrar.dnssec.signed"
-// +kubebuilder:printcolumn:name="Expires",type="date",JSONPath=".status.registrar.expirationDate"
-// +kubebuilder:printcolumn:name="DNS-Verify",type="string",JSONPath=".status.verification.requiredDNSRecords[0].content"
 
 // Domain represents a domain name in the Datum system
+//
+// +kubebuilder:printcolumn:name="Domain Name",type="string",JSONPath=".spec.domainName"
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="Verified",type="string",JSONPath=`.status.conditions[?(@.type=="Verified")].status`
+// +kubebuilder:printcolumn:name="Verification Message",type="string",JSONPath=`.status.conditions[?(@.type=="Verified")].message`,priority=1
 type Domain struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	Spec   DomainSpec   `json:"spec,omitempty"`
+	// +kubebuilder:validation:Required
+	Spec DomainSpec `json:"spec,omitempty"`
+
+	// +kubebuilder:default={conditions: {{type: "Verified", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"},{type: "VerifiedDNS", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"},{type: "VerifiedHTTP", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}}
 	Status DomainStatus `json:"status,omitempty"`
 }
 
 // DomainSpec defines the desired state of Domain
 type DomainSpec struct {
 	// DomainName is the fully qualified domain name (FQDN) to be managed
+	//
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=253
 	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	// +kubebuilder:validation:XValidation:message="A domain name is immutable and cannot be changed after creation",rule="oldSelf == '' || self == oldSelf"
+	// +kubebuilder:validation:XValidation:message="Must have at least two segments separated by dots",rule="self.indexOf('.') != -1"
 	DomainName string `json:"domainName"`
 }
 
@@ -43,9 +46,49 @@ type DomainStatus struct {
 	Conditions   []metav1.Condition        `json:"conditions,omitempty"`
 }
 
+const (
+	// This condition is true when Domain ownership has been verified via either
+	// DNS or HTTP.
+	DomainConditionVerified = "Verified"
+
+	// This condition tracks verification attempts via DNS.
+	DomainConditionVerifiedDNS = "VerifiedDNS"
+
+	// This condition tracks verification attempts via HTTP.
+	DomainConditionVerifiedHTTP = "VerifiedHTTP"
+)
+
+const (
+	// DomainReasonPendingVerification indicates domain verification is in
+	// progress
+	DomainReasonPendingVerification = "PendingVerification"
+
+	// DomainReasonVerificationRecordContentMismatch indicates the
+	// verification record content does not match expected values
+	DomainReasonVerificationRecordContentMismatch = "VerificationRecordContentMismatch"
+
+	// DomainReasonVerificationRecordNotFound indicates the verification record
+	// was not found
+	DomainReasonVerificationRecordNotFound = "RecordNotFound"
+
+	// DomainReasonVerificationUnexpectedResponse indicates that an unexpected
+	// response was encountered during verification.
+	DomainReasonVerificationUnexpectedResponse = "UnexpectedResponse"
+
+	// DomainReasonVerificationInternalError indicates that an internal error
+	// was encountered during verification.
+	DomainReasonVerificationInternalError = "InternalError"
+
+	// DomainReasonVerified indicates domain ownership has been successfully
+	// verified
+	DomainReasonVerified = "Verified"
+)
+
 // DomainVerificationStatus represents the verification status of a domain
 type DomainVerificationStatus struct {
-	RequiredDNSRecords []DNSVerificationExpectedRecord `json:"requiredDNSRecords,omitempty"`
+	DNSRecord               DNSVerificationRecord `json:"dnsRecord,omitempty"`
+	HTTPToken               HTTPVerificationToken `json:"httpToken,omitempty"`
+	NextVerificationAttempt metav1.Time           `json:"nextVerificationAttempt,omitempty"`
 }
 
 // DomainRegistrarStatus represents the registrar information for a domain
@@ -66,13 +109,18 @@ type DNSSECStatus struct {
 	Signed bool `json:"signed"`
 }
 
-// DNSVerificationExpectedRecord represents a DNS record required for verification
-type DNSVerificationExpectedRecord struct {
+// DNSVerificationRecord represents a DNS record required for verification
+type DNSVerificationRecord struct {
 	Name    string `json:"name"`
 	Type    string `json:"type"`
 	Content string `json:"content"`
 }
 
+type HTTPVerificationToken struct {
+	URL  string `json:"url"`
+	Body string `json:"body"`
+}
+
 // +kubebuilder:object:root=true
 
 // DomainList contains a list of Domain

api/v1alpha/httpproxy_types.go

@@ -10,6 +10,46 @@ import (
 
 // HTTPProxySpec defines the desired state of HTTPProxy.
 type HTTPProxySpec struct {
+
+	// Hostnames defines a set of hostnames that should match against the HTTP
+	// Host header to select a HTTPProxy used to process the request.
+	//
+	// Valid values for Hostnames are determined by RFC 1123 definition of a
+	// hostname with 1 notable exception:
+	//
+	// 1. IPs are not allowed.
+	//
+	// Hostnames must be verified before being programmed. This is accomplished
+	// via the use of `Domain` resources. A hostname is considered verified if any
+	// verified `Domain` resource exists in the same namespace where the
+	// `spec.domainName` of the resource either exactly matches the hostname, or
+	// is a suffix match of the hostname. That means that a Domain with a
+	// `spec.domainName` of `example.com` will match a hostname of
+	// `test.example.com`, `foo.test.example.com`, and exactly `example.com`, but
+	// not a hostname of `test-example.com`. If a `Domain` resource does not exist
+	// that matches a hostname, one will automatically be created when the system
+	// attempts to program the HTTPProxy.
+	//
+	// In addition to verifying ownership, hostnames must be unique across the
+	// platform. If a hostname is already programmed on another resource, a
+	// conflict will be encountered and communicated in the `HostnamesVerified`
+	// condition.
+	//
+	// Hostnames which have been programmed will be listed in the
+	// `status.hostnames` field. Any hostname which has not been programmed will
+	// be listed in the `message` field of the `HostnamesVerified` condition with
+	// an indication as to why it was not programmed.
+	//
+	// The system may automatically generate and associate hostnames with the
+	// HTTPProxy. In such cases, these will be listed in the `status.hostnames`
+	// field and do not require additional configuration by the user.
+	//
+	// Wildcard hostnames are not supported at this time.
+	//
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxItems=16
+	Hostnames []gatewayv1.Hostname `json:"hostnames,omitempty"`
+
 	// Rules are a list of HTTP matchers, filters and actions.
 	//
 	// +kubebuilder:validation:Required
@@ -107,7 +147,7 @@ type HTTPProxyStatus struct {
 	// Hostnames lists the hostnames that have been bound to the HTTPProxy.
 	//
 	// If this list does not match that defined in the HTTPProxy, see the
-	// `Programmed` condition message for details.
+	// `HostnamesVerified` condition message for details.
 	Hostnames []gatewayv1.Hostname `json:"hostnames,omitempty"`
 
 	// Conditions describe the current conditions of the HTTPProxy.
@@ -126,6 +166,14 @@ const (
 	// programmed into underlying Gateway resources, and those resources have also
 	// been programmed.
 	HTTPProxyConditionProgrammed = "Programmed"
+
+	// This condition is true when all hostnames defined in an HTTPProxy or a
+	// Gateway listener have been verified.
+	HTTPProxyConditionHostnamesVerified = "HostnamesVerified"
+
+	// This condition is present and true when a hostname defined in an HTTPProxy
+	// is in use by another resource.
+	HTTPProxyConditionHostnamesInUse = "HostnamesInUse"
 )
 
 const (
@@ -144,6 +192,18 @@ const (
 	// conditions when the status is "Unknown" and no controller has reconciled
 	// the HTTPProxy.
 	HTTPProxyReasonPending = "Pending"
+
+	// This reason is used with the "HostnamesVerified" condition when all hostnames
+	// defined in an HTTPProxy or Gateway listener have been verified.
+	HTTPProxyReasonHostnamesVerified = "HostnamesVerified"
+
+	// This reason is used with the a hostname defined in an HTTPProxy or Gateway
+	// has not been verified.
+	UnverifiedHostnamesPresent = "UnverifiedHostnamesPresent"
+
+	// This reason is used with the a hostname defined in an HTTPProxy or Gateway
+	// is in use by another resource.
+	HostnameInUseReason = "HostnameInUse"
 )
 
 // +kubebuilder:object:root=true

api/v1alpha/zz_generated.deepcopy.go

@@ -227,7 +227,9 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err := (&controller.DomainReconciler{}).SetupWithManager(mgr); err != nil {
+	if err := (&controller.DomainReconciler{
+		Config: serverConfig,
+	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Domain")
 		os.Exit(1)
 	}
@@ -238,11 +240,10 @@ func main() {
 	}
 
 	validationOpts := validation.GatewayValidationOptions{
-		ControllerName:          serverConfig.Gateway.ControllerName,
-		PermittedTLSOptions:     serverConfig.Gateway.PermittedTLSOptions,
-		ValidPortNumbers:        serverConfig.Gateway.ValidPortNumbers,
-		ValidProtocolTypes:      serverConfig.Gateway.ValidProtocolTypes,
-		CustomHostnameAllowList: serverConfig.Gateway.CustomHostnameAllowList,
+		ControllerName:      serverConfig.Gateway.ControllerName,
+		PermittedTLSOptions: serverConfig.Gateway.PermittedTLSOptions,
+		ValidPortNumbers:    serverConfig.Gateway.ValidPortNumbers,
+		ValidProtocolTypes:  serverConfig.Gateway.ValidProtocolTypes,
 	}
 
 	if err := networkinggatewayv1webhooks.SetupGatewayWebhookWithManager(mgr, validationOpts); err != nil {